Forum Moderators: open
I'm running a simple test script on the theory that if I get this to work, everything will be all set up properly for what I need to do.
I have simple dynamic pages on my site. The url structure for these pages are structured as follows:
<code>
mysite.com/myfolder/my-product-index-page.php?name=Individual Product Name
</code>
(notice the white space between the words)
Like other sales pages, there is both an index page of products and a detailed individual product page. As for the products, there are only a few of them but they come in a multitude of colors. As such, I only show one color on the product index page to avoid cluttering everything up.
However, on the detailed product pages I want to show the multitude of colors available for that particular product.
To accomplish this, I had planned on using $_GET. I use $_GET to pull the Product Name from the url with the following code:
$id = $_GET['name'];
echo $id;
This code is working properly as I see the output of the product name properly printed out on the page. What's printed out is matching what is in the database too, whitespace between the words and all. There is also no extra whitespace at the end of the output, either - again matching what is in the database.
However, when I use $id variable to locate other products in the database that have identical names (the 'NAME' field), I'm getting zero results (even though I should be getting 2-20). The code I use is as follows for the MySQL query.
$result = mysql_query('select * FROM Table WHERE NAME = "$id"');
$num_rows = mysql_num_rows($result);
echo $num_rows;
Any ideas on why I'm getting 0 results despite having between 2-20 results in the database that match the $id variable? Is the whitespace somehow messing something up?
Thanks
Jim
Any ideas on why I'm getting 0 results.....?
Yes. :-)
'select * FROM Table WHERE NAME = "$id"'
Single quotes will not interpolate variables, so you are in essence you are searching for a literal value $id.
It's always better to store your selects in variables anyway. Try something like this.
$select = 'select * FROM Table WHERE NAME = "' . $id . '"'; // last is single quote, double quote, single quote
$result = mysql_query($select);
Before going live though, do a little cleansing on your input variables, make sure the input variable (name) is not the same as your table field name, this is open to mySQL injection.
You'll also have to consider what to do in cases like this
mysite.com/myfolder/my-product-index-page.php?name=Large "Supersize" Widget
As the input quotes will likely create problems with the select statements, you will need to escape them, etc.
Last, spaces in a URL is a Very Bad Idea. If it manages to get into serps, what you get is
mysite.com/myfolder/my-product-index-page.php?name=Individual%20Product%20Name
A better approach might be
mysite.com/myfolder/my-product-index-page.php?name=Individual-Product-Name
and sub out the dashes prior to building the select.
